Nginx Ingress Controller forward all NTP (UDP 123) traffic to a public time server

Question

I have an nginx ingress controller deployed using helm. It uses LB of type NLB defined in service section.

I am searching for the following solution When an edge router from on-prem forwards all ntp requests to this nginx ingress Controller , it forwards those requests to public ntp server e.g. time.aws.com

Is there any way of achieving this

My understanding is that it is not possible using ingress as its for http and https traffic only

This doc TCP and UDP mentions exposing UDP and TCP services in nginx ingress controller but this doesn't seem to solve my problem as not sure how would Ingress controller forward all UDP 123 traffic to an external time server ?

Using service of type "ExternalName" ExternalName. But this also seems when used with ingress would not support my use case of UDP 123 port.

nginx proxypass . Would it be possible to achieve something with that? Not sure if I can add something in config: section of my helmfile.

Here is the helmfile I use.

---
repositories:
- name: ingress-nginx
  url: https://kubernetes.github.io/ingress-nginx

helmDefaults:
  verify: false
  wait: false
  timeout: 500
  recreatePods: false
  force: false
  createNamespace: false

releases:
- name: ingress-nginx
  version: 4.10.0
  namespace: default
  missingFileHandler: "Error"
  chart: ingress-nginx/{{`{{ .Release.Name }}`}}
  values:
  - ./values.yaml

Here is the values.yaml file

---
# Set RBAC scope to namespaced
rbac:
  scope: true

controller:
  replicaCount: 2

  # Set scope of the ingress controller to namespaced
  scope:
    enabled: true

  # Disable admission webhook resources
  admissionWebhooks:
    enabled: false

  # Enable ingress-class resource, this ingress controller will watch all ingress resources in scope regardless of class
  watchIngressWithoutClass: true
  ingressClassResource:
    enabled: true

  config:
    # Add additional listen port to use in place of the default https port, see service.targetPorts
    # Port 8000 (http) is used as the target for 443 on the NLB, if traffic arrives on 80 it will be forwarded to 8000
    # by redirecting to https on the NLB
    server-snippet: |
      listen 8000 proxy_protocol;
      if ( $server_port = 80 ) {
         return 308 https://$host$request_uri;
      }

    # Enable the use of proxy protocol on the ingress controller
    enable-real-ip: true
    use-forwarded-headers: "true"
    real-ip-header: proxy_protocol
    use-proxy-protocol: true

    allow-snippet-annotations: "true"
    client-header-buffer-size: 16k
    client-max-body-size: 100M
    compute-full-forwarded-for: "true"
    ssl-redirect: "false" # we use `special` port to control ssl redirection
    large_client_header_buffers: 2 128k
    keep-alive: "3600"
    max-worker-open-files: "2048"
    proxy-body-size: 12m
    proxy-buffer-size: 16k
    proxy-buffering: "on"
    proxy-buffers-number: "8"
    proxy-connect-timeout: "3600"
    proxy-read-timeout: "3600"
    proxy-send-timeout: "3600"
    proxy_buffers: 8 128k
    send_timeout: "3600"
    use-http2: "false"

  containerPort:
    http: 80
    https: 443
    special: 8000

  service:
    targetPorts:
      http: http
      https: special
    externalTrafficPolicy: "Local"
    loadBalancerSourceRanges:
      - <private ip range1>
      - <private ip range2>

    annotations:
      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
      service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60"
      service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "true"

      # Use ACM certificate for the NLB - this terminates SSL at the NLB on port 443
      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: <acm cert arn>
      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: https

      # Use NLB with IP target type - this routes traffic directly to the pod IP
      service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
      service.beta.kubernetes.io/aws-load-balancer-internal: "true"
      service.beta.kubernetes.io/aws-load-balancer-name: ntp-ingress-controller

      # Enable proxy protocol on the NLB
      service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"

Following solutions which are not using Ingress controller, I tried and worked fine but it was mentioned to me to try and see if I can make this solution work using existing nginx ingress controller.

I used an EC2 as a relay to sync from AWS Time sync service (169.254.169.123)

I used a kubernetes service of type LB and behind that deployed a proxy pod using python code which forwards all NTP traffic to the public time server and the edge router can sync through this NLB->proxypod -> public NTP server, But as mentioned preference is to use existing infra (ingress controller) to achieve this if possible. Any help would be much appreciated. Thanks